Analysis

  • max time kernel
    145s
  • max time network
    142s
  • platform
    android_x86
  • resource
    android-x86-arm-20240624-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240624-enlocale:en-usos:android-9-x86system
  • submitted
    04-12-2024 14:23

General

  • Target

    008db830f8edcbe87ef15195781ebdd0.apk

  • Size

    8.2MB

  • MD5

    008db830f8edcbe87ef15195781ebdd0

  • SHA1

    27ea98e1360452af56ef4c6972ced15fe13eba3e

  • SHA256

    9bfef457ff38d9e658b63586075fa3b6db5478b9309b2d0d9bda8c0b9ca7db5f

  • SHA512

    60a00a3ac96986f222c374924f5b8bc23347d3c75668dfb633dce05c532a482b6ed7cc802e979e10be120385b6f2ceec7e8b5a380cbd1940d21c1a9191a70f71

  • SSDEEP

    196608:wkbu/0PvCjDi4SpWzA2zSWxzL8PVWPn5GMb9dXzd4:wwW0PyxSeVKUP5Rp4

Malware Config

Signatures

  • TangleBot

    TangleBot is an Android SMS malware first seen in September 2021.

  • TangleBot payload 2 IoCs
  • Tanglebot family
  • Loads dropped Dex/Jar 1 TTPs 2 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 3 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Acquires the wake lock 1 IoCs
  • Requests disabling of battery optimizations (often used to enable hiding in the background). 1 TTPs 1 IoCs
  • Requests enabling of the accessibility settings. 1 IoCs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Processes

  • com.ltjkqj.erfycvar
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Requests disabling of battery optimizations (often used to enable hiding in the background).
    • Requests enabling of the accessibility settings.
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4249
    • /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.ltjkqj.erfycvar/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.ltjkqj.erfycvar/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&
      2⤵
      • Loads dropped Dex/Jar
      PID:4279

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.ltjkqj.erfycvar/code_cache/secondary-dexes/tmp-base.apk.classes4710242196602311504.zip

    Filesize

    700KB

    MD5

    0e83370014f555fd02f2b5469b26bc93

    SHA1

    e328f134c9124b4d3618f7d5636e045a163fd868

    SHA256

    1f231f7732ab1128d69c199f49abef9a5157466e48239e366c178c28e735870e

    SHA512

    0168b4e4d6fef6572c33672980e14f5d6d8617cc93a2d33beeb7e28933ca2739c14cbce500ecc31145caab433c64b65c705b17b17f8a220a5ffaf0108b9fc587

  • /data/user/0/com.ltjkqj.erfycvar/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    1.9MB

    MD5

    dd56df1015c97ea7370a1477ed6917d3

    SHA1

    a5a5d5d640f9b305d33695222aea310899a2ba31

    SHA256

    78c8396f2ee00d95f5f47af3f883b1c0498bd7beae65822fbdaaa64db6dd170a

    SHA512

    9dca8fc449a242fd2b5c61149f31a0bfe3bee985191419c35088b62805522959908a5b2910c325d400da4ae32a7df0268e7b0f7cbd5dfab6070c62d60856540c

  • /data/user/0/com.ltjkqj.erfycvar/code_cache/secondary-dexes/base.apk.classes1.zip

    Filesize

    1.9MB

    MD5

    897cf21f2a12df450ecf6294fbb3653d

    SHA1

    aebc6b845facc4aa1ecfae91ba81ccbf5a31ff2c

    SHA256

    d803c898445814582805089f296e338fa23bab4415d6e6175d495f131a5101e4

    SHA512

    bc6f9c53229ad3c90c70ec843e420df3ef2aa15aa9eae54e1c1d1b7e05fad6fce9a6e3ece2a9d06f1e1dc1a7307c121e1c9a9d34c7c3d6c2ba968e1d0d453bc9